CVE-2004-0584

CVE-2004-0584 refers to an input validation vulnerability in Horde IMP up to version 3.2.3 (and earlier) that can allow remote attackers to inject script via HTML or script in email messages, potentially triggering a cross-site scripting (XSS) condition. Affected software: Horde IMP 3.2.3 and ear...

Horde-IMP: Input validation vulnerability

Background Horde-IMP is the Internet Messaging Program. It is written in PHP and provides webmail access to IMAP and POP3 accounts. Description Horde-IMP fails to properly sanitize email messages that contain malicious HTML or script code. Impact By enticing a user to read a specially crafted...

IMP Content-Type Header XSS

The remote server is running at least one instance of IMP whose version number is between 2.0 and 3.2.3 inclusive. Such versions are vulnerable to a cross-scripting attack whereby an attacker may be able to cause a victim to unknowingly run arbitrary JavaScript code simply by reading a MIME messa...

Horde IMP IMP_MIME_Viewer_html Class XSS

The remote server is running at least one instance of IMP whose version number is between 3.0 and 3.2.1 inclusive. Such versions are vulnerable to several cross-scripting attacks whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code simply by reading an HTML message...

CVE-2001-1370

CVE-2001-1370 affects PHPLib before 7.2d when register_globals is on, allowing remote code execution by sending an HTTP request that overwrites $_PHPLIB[libdir] to load code from another server. The issue is observed in Horde 1.2.5 and earlier, and in IMP before 2.2.6. Debian’s DSA-073-1 referenc...

CVE-2002-0181

CVE-2002-0181 — Horde IMP status.php3 XSS is confirmed in connected OpenVAS/NVD entries. The vulnerability arises in the status.php3 parameter handling of IMP 2.2.8 and HORDE 1.2.7, where user-supplied data is not properly sanitized, enabling cross-site scripting and potential cookie theft when a...

CVE-2002-0181

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...

Horde IMP mailbox.php3 Multiple Parameter SQL Injection

The remote server is running IMP, a web-based mail client. There is a bug in the installed version which allows an attacker to perform a SQL injection attack using the 'actionID' parameter of the 'mailbox.php3' script. An attacker may use this flaw to gain unauthorized access to a user mailbox or...

CVE-2003-0025

Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as checkprefs in db.pgsql, as demonstrated using mailbox.php3...

[SECURITY] [DSA 229-2] New IMP packages fix SQL injection and typo

-------------------------------------------------------------------------- Debian Security Advisory DSA 229-2 [email protected] http://www.debian.org/security/ Martin Schulze January 15th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 229-1] New IMP packages fix SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 229-1 [email protected] http://www.debian.org/security/ Martin Schulze January 15th, 2003 http://www.debian.org/security/faq -...

CVE-2003-0025

Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as checkprefs in db.pgsql, as demonstrated using mailbox.php3...

CVE-2003-0025

IMP is a web-based IMAP mail client, affected in versions up to 2.2.8 and earlier. The CVE describes multiple SQL injection vulnerabilities that allow a remote attacker to perform unauthorized database activities and potentially gain privileges, via functions such as check_prefs() in db.pgsql and...

DSA-229 imp - SQL injection

Bulletin has no description...

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...

PT-2002-2745 · Horde · Horde Imp

Name of the Vulnerable Software and Affected Versions: Horde IMP version 2.2.7 Description: The issue allows remote attackers to obtain the full web root pathname via specific HTTP requests. This can be achieved by requesting certain files, including poppassd.php3, login.php3?reason=chpass2,...

CVE-2001-1258

CVE-2001-1258 affects the Horde IMP before 2.2.6. According to the Debian DSA-073-1 advisory and related sources, a hostile user who can place a publicly readable prefs.lang file on the Apache/PHP server can have that file executed as PHP code, enabling access to config data and potentially the H...

CVE-2001-1257

The CVE-2001-1257 entry affects the Horde IMP web-based IMAP client, with vulnerable versions before 2.2.6 and 1.2.6. The underlying issue is a cross-site scripting (XSS) flaw that allows an attacker to embed JavaScript in an email, which could execute in a user’s browser when viewing the message...

CVE-2002-0181

Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter...

[SECURITY] [DSA-126-1] Horde and IMP cross-site scripting attack

Package : imp Problem type : cross-site scripting CSS Debian-specific: no A cross-site scripting CSS problem was discovered in Horde and IMP a web based IMAP mail package. This was fixed upstream in Horde version 1.2.8 and IMP version 2.2.8. The relevant patches have been back-ported to version...